Blockchain analytics firm Elliptic says several crypto exchanges that retain operational or financial links to Russia are still helping route digital asset flows connected to sanctions evasion. The mechanism is simple: rubles are converted into crypto, transferred across borders on-chain, and kept outside the visibility of traditional banking controls.
Bitpapa and ABCeX accused of masking activity through wallet rotation
In the report, Elliptic names Bitpapa, a peer-to-peer exchange registered in the UAE that largely serves Russian users seeking ruble-to-crypto trades. The U.S. Office of Foreign Assets Control sanctioned Bitpapa in March 2024. Elliptic says about 9.7% of the platform’s outbound crypto flows reach OFAC-sanctioned targets, with roughly 5% going to sanctioned exchange Garantex.
According to the report, Bitpapa rotates wallet addresses on a regular basis, making it harder for transaction monitoring systems to identify the platform as a counterparty. Elliptic says this obscures the Russian origin of funds. ABCeX is described in similar terms. The exchange operates from Moscow’s Federation Tower, a site previously used by Garantex, and has processed at least $11 billion in crypto while offering both order-book trading and P2P ruble-to-crypto services.
Elliptic says ABCeX also uses wallet-concealment tactics to prevent on-chain transfers from being directly tied to the exchange. The platform has sent funds to Garantex and to Aifory Pro, a service focused on cash-to-crypto transactions. In this structure, fiat currencies including rubles are converted into crypto, moved across borders, and later exchanged into local currency through overseas brokers or exchanges.
Exmo’s claimed Russia exit conflicts with shared wallet infrastructure
Elliptic also scrutinizes Exmo. After Russia’s 2022 invasion of Ukraine, Exmo said it had left the Russian market by selling its regional business to Exmo.me. Elliptic’s blockchain analysis disputes the idea that the two operations are actually separate.
The report says Exmo.com and Exmo.me still use the same custodial wallet infrastructure. Deposits made to either platform are pooled into identical hot wallet addresses, while withdrawals from both are issued from matching addresses. Elliptic argues that this means there is no real operational split, leaving funds from the Russia-facing business mixed with those tied to the Western-facing platform. The firm says Exmo has transacted with Garantex, Grinex, and Chatex, and has carried out more than $19.5 million in direct transactions with sanctioned entities.
Rapira and Aifory Pro also appear in the report
Two other platforms are highlighted as well. Rapira, incorporated in Georgia with an office in Moscow, supports ruble-based trading and has conducted direct crypto transactions with Grinex totaling more than $72 million, according to Elliptic. The report also cites claims that Moscow authorities raided Rapira’s offices during an investigation tied to capital flight to Dubai.
Aifory Pro operates in Moscow, Dubai, and Turkey, describing itself as a “Foreign Economic Activity Payment Agent” for trade between Russia and China. Elliptic’s broader point is that exchanges and payment services with nominal registrations outside Russia can still be deeply involved in high-volume trading linked to sanctioned entities.